Quantum Direct Communication with Continuous Variables 
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We show how continuous variable systems can allow the direct communication of messages with 
an acceptable degree of privacy. This is possible by combining a suitable phase-space encoding of the 
plain message with real-time checks of the quantum communication channel. The resulting protocol 
works properly when a small amount of noise affects the quantum channel. If this noise is non- 
tolerable, the protocol stops leaving a limited amount of information to a potential eavesdropper. 

PACS numbers: 03.67.Dd, 03.67.Hk, 42.50.-p 



INTRODUCTION 

In recent years, quantum communication protocols 
have been extended to the domain of continuous variable 
(CV) systems, i.e., quantum systems, like the bosonic 
modes of the radiation field, which are characterized by 
infinite dimensional Hilbert spaces [![. In particular, it 
has been understood how a sender (Alice) can exploit 
bosonic modes in order to send analog signals to a re- 
ceiver (Bob) and then extract a secret binary key from 
these signals 0, Beyond the possibility of such a 
continuous variable quantum key distribution (QKD), 
here we show how to use these systems in order to per- 
form a (quasi)confidential quantum direct communica- 
tion (QDC) [J], i.e., the (quasi)private communication of 
a message from Alice to Bob which is directly encoded in 
CV systems. 

The ideal situation for QDC trivially occurs when Alice 
and Bob are connected by a noiseless channel. However, 
in general, this is not the case and the honest users must 
randomly switch their confidential communication with 
real-time checks on the channel. As soon as they detect 
the presence of a non-tolerable noise, they promptly stop 
the communication. The maximum noise that can be tol- 
erated is connected to the maximum amount of informa- 
tion that they are willing to give up to an eavesdropper. 
In other words, a good QDC protocol should enable Alice 
and Bob to communicate all the message when the noise 
is suitably low, while losing a small amount of informa- 
tion when it is not. 

Let us consider a bosonic mode described by quadra- 
ture operators q and p, satisfying [q,p] — i. An ar- 
bitrary state of the system (density operator p) must 
fulfill the uncertainty principle V(q)V(p) > 1/4, where 
V(x) — Tr(px 2 ) — [Tr(px)] 2 denotes the variance of the 
arbitrary quadrature x — q or p. In particular, coherent 
states satisfy V(q) = V(p) := A, where A — 1/2 repre- 
sents the quantum shot-noise. This is the fundamental 
noise that affects disjoint measurements of the quadra- 
tures q and p (homodyne detection), and it is doubled 



to A = 1 when the two quadratures are jointly mea- 
sured (heterodyne detection). A density operator p may 
be faithfully represented by the Wigner quasi-probability 
distribution W(q,p), whose continuous variables q and p 
are the eigenvalues of the quadratures. In this phase- 
space representation, states with Gaussian Wigner func- 
tions are called Gaussian states. This is the case of a 
coherent state \a), whose Gaussian Wigner function is 
centered at a = 2~ 1 ^ 2 (q + ip). For coherent states the 
detection of an arbitrary quadrature x provides outcomes 
x following the marginal distribution 
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where A = 1/2 for homodyne and A = 1 for heterodyne. 



THE PROTOCOL 

Let us show how Alice can transmit message bits by 
using the phase-space of a bosonic mode. We discretize 
the phase-space via a square lattice of half-step size f2. 
Then, an arbitrary cell specifies the values of two bits 
(it, u 1 ) which are given by the parity of its address along 
the q and p axes (see Fig. [1}. In a simple lattice en- 
coding, Alice embeds two bits (u, vl) by randomly choos- 
ing a target cell with parities (u, u') or, equivalently, by 
constructing the message amplitude a uu > pointing at the 
center of that target cell. Then, in a first naive protocol, 
Alice directly prepares the coherent state \a uu i) from the 
message amplitude a uu > . Such a state is sent to Bob, 
who performs a heterodyne detection for extracting a uu > 
and, therefore, the pair (u,u'). Notice that, even in the 
presence of a noiseless channel, Bob's decoding cannot 
be perfect since the Gaussian shape of the coherent state 
spreads over the whole phase space and this leads to an 
intrinsic error. It is easy to check that the probability of 
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FIG. 1: Square lattice in phase-space with unit cell of size 
20.. Each cell specifies the values of a pair of bits (u, u'). 



an intrinsic error (per transmitted bit) is 
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In particular, here we fix fl ~ 2.57 in order to have the 
reasonable low value of e = 1%. On the one hand, such 
a choice for f2 enables Bob to approach an error-free de- 
coding when the communication channel is noiseless. On 
the other hand, it makes the protocol fragile to eaves- 
dropping since Eve can optimize her attack to the struc- 
ture of the lattice, e.g., by using non-universal quantum 
cloning machines. 

Fortunately, we can preclude these strategies by adding 
a simple classical (masking) step to the above procedure. 
In fact, after having computed the message amplitude 
a uu >, Alice can add a mask amplitude olm, in such a 
way that the total signal amplitude a :— olm + aw is 
continuously distributed in phase space according to a 
spread Gaussian (see Fig. [T]) . Then, in a second refined 
protocol, Alice prepares the message a uu i , the mask ajf 
and the signal state \a) (see Fig. |5J). As a first step, Al- 
ice sends the signal state \a) to Bob, who heterodynes it 
with outcome (3 ~ a. Then, after Bob's confirmation 
of detection, Alice classically communicates the mask 
Ofcf. As a consequence of these steps, Bob gets the pair 
(/3, Q!m) from his detection and Alice's communication. 
Then, Bob is able to unmask the signal by computing 
(3 — olm — a — olm = ol uu i and, therefore, retrieves the 
message bits (u, u') via lattice decoding. The key-point 
here is that Eve must choose the probing interaction be- 
fore knowing the value of the mask. Since the continuous 
signal a is highly modulated, the best choice is to adopt 
a universal interaction which does not privilege any par- 
ticular portion of the phase-space. Here, we consider for 
Eve the usage of a universal Gaussian quantum cloning 
machine (UGQCM) [|. Such a machine maps the sig- 
nal state | a) into a pair of output clones ps (sent to 
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FIG. 2: Message mode (MM). From the message bits 
(u,u'), Alice computes the message amplitude a uu i (lattice 
encoding) and then adds the mask olm achieving the signal 
amplitude a. Then, Alice prepares and sends to Bob the 
signal state \a), that Bob heterodynes with outcome (3 (step 
1 in the picture). After detection, Bob classically informs 
Alice (step 2) and, then, Alice classically communicates the 
mask olm (step 3). At that point, Bob is able to unmask 
the signal (/3 — aj;), thus reconstructing a uu i and, therefore, 
(u,u). 



Bob) and pe (taken by Eve), equal to a Gaussian mod- 
ulation of | a) (ol\ with cloning variances a B := a 2 and 
a\ = (4cr 2 ) _1 . This means that the arbitrary quadra- 
ture x of the clone K = B, E has a marginal distribution 
equal to G*F, 2 (x — x). 
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FIG. 3: Control mode (CM). Alice picks up a Gaussian 
amplitude a and prepares a signal coherent state |fi). Such a 
state is sent to Bob, who heterodynes it with outcome f3 (step 
1 in the picture). Then, Bob classically informs Alice (step 
2) and Alice communicates the value of the signal a (step 3). 
At that point, Bob computes the test variable r := /3 — a and 
tests the noise of the channel. 

The above procedure of directly communicating mes- 
sage bits is called the message mode (MM) of the proto- 
col. However, Alice and Bob have to also perform real- 
time controls of the added noise a 2 on the channel. This 
is possible if Alice randomly switches from message mode 
instances to suitable instances of control mode (CM) 0]. 
In control mode (see Fig. [3]) , Alice does not process any 
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text message but only prepares and sends the signal state 
\a). Then, after Bob's detection (outcome Alice com- 
municates the value a of the signal amplitude. At that 
point, Bob extracts from (/?, a) the actual value of the 
test variable r :— [3 — a which is then used to infer the 
total noise Ab = 1 + a 2 affecting the signal. As soon 
as they recognize a non-tolerable noise, i.e., a 2 > a 2 for 
some threshold noise a 2 , they stop the communication. 
Hereafter, we assume a zero-tolerance protocol where no 
added noise is tolerated on the channel, i.e., a 2 — 0. We 
shall see that the QDC protocol can be applied in realistic 
situations even with such a strict condition Q- 

Let us show how the real-time check works in detail. 
For each control mode, Bob collects the two quadra- 
tures x — q,p of the test variable r. Then, after M 
control modes, he has collected 2M quadratures val- 
ues {xx,X2,--- ,X2M-i,X2m} which give the estimator 
v = J2i=i x h By using this estimator, Bob must distin- 
guish the two hypotheses 

H = no Eve & a 2 = , H 1 = yes Eve <^ a 2 ^ . (3) 

Let us fix the confidence level r (i.e., the probability to 
reject H a though true) to a reasonably low value (e.g., 
r = 5 x 1CP 7 ). Then, the hypothesis Hq is accepted if 
and only if 
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where Vij is the j'th quantile of the % 2 distribution with 
i degrees of freedom. In other words, Alice and Bob 
continue their direct communication in MM as long as 
the condition of Eq. (TJ| is satisfied in CM. 

Let us explicitly analyze what happens when the 
channel is subject to eavesdropping. In an individual 
UGQCM attack, Eve clones the signal input and, then, 
heterodynes her output to estimate the signal amplitude 
a. After the release of the mask's value o,m, Eve infers 
the message amplitude a uu ' and, therefore, the input bits 
(it, it'). In this process, Eve introduces an added noise a 2 
on the Alice-Bob channel, while her output is affected 
by a total noise equal to = 1 + (4c 2 ) -1 . On the one 
hand, we must compute the probability IIm((t 2 ) that Eve 
evades M control modes while introducing noise a 2 ^ 0. 
After some algebra we get 
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where T(z,a) := J Q +0 ° dt t z ~ 1 e~ t is the incomplete 
gamma function. On the other hand, we must evaluate 
the amount of information she can steal during her unde- 
tected life on the channel. Let us assume that every input 
bit is a bit of information. As a consequence, the stolen 
information per MM is equal to Iae — 2[1 — H{p)\, where 
H(p) := — plogp — (1— p) log(l— p) &ndp = e(f2, Ae) can 
be computed from Eq. @. By combining II m and Iae, 



)]/(M-l)!, 
(5) 



we can derive Eve's survival probability as a function of 
the stolen information. Let c be the probability of a con- 
trol mode, so that N runs of the protocol are composed 
by cN control modes and (1 — c)N message modes, on 
average. As a consequence, the survival probability will 
be P := H c n(<J 2 ) and the average number of stolen bits 
will be / := (1 — c)NIae{& 2 )- Then, for every value of 
c and cr 2 , we can determine the function P = P(I). Let 
us fix c = 69/70 so that the protocol has efficiency 
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In Fig. IU we have numerically plotted P — P(I) for sev- 
eral values of the added noise a 2 . If the noise is low, e.g., 
a 2 = 0.01, Eve steals very little information (~ 1 bit) 
while Alice and Bob complete an almost noiseless QDC. 
In particular, Alice is able to transmit ~ 1.5 x 10 4 bits of 
information by using N ~ 5 x 10 5 systems. Notice that 
the maximum length of the QDC is roughly bounded by 
the verification of r _1 hypothesis tests and, therefore, it 
is limited to about 4(1 — c)(cr) _1 bits (i.e., ~ 1.2 x 10 5 
bits or ~ 4 x 10 6 systems using the above parameters). If 
the attack is more noisy (e.g., a 2 = 1), Eve again steals 
little information (~ 1 bit). In such a case, in fact, Eve 
is promptly detected by the honest parties who, how- 
ever, are prevented from exchanging information (denial 
of service). According to Fig. [4] Eve's best strategy cor- 
responds to use a UGQCM with a 2 ~ 1/20, so that she 
can steal ~ 80 bits before being revealed (for a cut off of 
P = 1%). In such a case, Alice transmits ~ 630 bits by 
using JV~2.2x 10 4 systems. 

How can we decrease the maximal amount of stolen 
information? One possible solution is to increase fur- 
ther the control mode probability c, so that the eventual 
presence of Eve is detected before sending too many bits. 
However, this approach affects the efficiency £. An alter- 
native and better solution consists of making the decod- 
ing more sensitive to the presence of added noise. Such 
an approach is possible by introducing classical error cor- 
recting codes. 



IMPROVING QDC VIA REPETITION CODES 

In the basic scheme of QDC with continuous variables, 
noiseless communication is possible up to an intrinsic er- 
ror probability e depending on CI. In particular, such 
a probability decreases for increasing fi. An alterna- 
tive way for decreasing e consists of leaving f2 unchanged 
while introducing a classical error correcting code. Such 
procedures are essentially equivalent for a noiseless chan- 
nel, since e is sufficiently small and the codes work very 
well in that case. However, the scenario is different as 
the channel becomes noisier. In such a case, in fact, the 
correcting codes have a non-linear behavior which makes 
their performance rapidly deteriorate. Such a non-linear 



4 



l 



P 



\ \\ \ 




(a) 


1 w \ 

\o.4 \\ 

\\o.2 


\0.05 




\ 0.02\\ 






0.01 \ \V 







10 20 30 40 50 60 70 
/ 



P 







(b) 


\ vV 








\fti\ft3 











2 4 6 8 10 12 

/ 



FIG. 4: Survival probability P versus the number of stolen 
bits /. In (a) no codes are used while in (b) a repetition code 
with n = 35 is used. The curves refer to UGQCM attacks 
with different values of added noise a 2 . 

effect can be exploited to critically split the correction ca- 
pabilities, and therefore the information gains, between 
the Alice-Bob channel and the Alice-Eve channel. 

For the simplest case of an n-bit repetition code, an 
input bit U — {0, 1} is encoded into a logical bit U = 
{0, 1} of n physical bits via the codewords 

= 00 •••(), 1 = 11 • - • 1 . (7) 

n n 

By choosing an odd n = 2m + 1 (with m = 1, 2, • • • ), 
we can apply a non-ambiguous majority voting criterion. 
This means that every bit-flip error of weight t < m+1 is 
correctable, while every bit-flip error of weight t > m + 1 
is not. Let us now consider a memoryless channel, where 
each physical bit is perturbed independently with the 
same bit-flip probability p (as happens in the case of in- 
dividual attacks). Then, the probability of an uncor- 
rectable error is given by 

Pn( P )= £ (l)p k (l-pr- k . (8) 
k=m+l ^ ' 

For a sufficiently large n, the curve P n {p) displays a crit- 
ical point after which the correction capability suddenly 



starts to deteriorate very quickly (see, e.g., Fig.[5j show- 
ing p ~ 0.3 for n — 35 and p ~ 0.4 for n = 103). Exactly 
these critical points enable one to improve the QDC by 
transforming the communication protocol into a thresh- 
old process, where the sensitivity to added noise is re- 
markably amplified. 
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P 

FIG. 5: Probability of an uncorrectable error P n versus the 
single bit-flip probability p. Here, we consider repetition codes 
with n = 7; 15; 35; 103. 

Let us choose a critical lattice's half-step (l, i.e., lead- 
ing to a critical intrinsic error probability e — p. On 
the one hand, when the channel is noiseless, Bob is able 
to recover the codewords and reconstruct the logical bit 
with a very low error probability Pb — Pn(p) (that we 
call the logical intrinsic error probability). On the other 
hand, when the channel is noisy, Alice's information is 
split into two sub-channels: the Alice-Bob channel, with 
added noise a B = a 2 , and the Alice-Eve channel, with 
added noise a% = (4cr 2 ) _1 . The corresponding error 
probabilities are respectively given by 

Pb =P n {P + Pb) , Pe = Pn{P + Pe) , (9) 

where pb — Pb{o~b) an( i Pe = Pe(&e) are nionotonic 
functions of the added noises (and are therefore linked 
by the uncertainty principle). Now, if Eve tries to hide 
herself by perturbing the Alice-Bob channel with a rel- 
atively small pb, then her dual p^ will always be big 
enough to perturb p into the nonlinear region. As a con- 
sequence, Eve will tend to experience Pe — 1/2, gaining 
her negligible information. 

Let us explicitly show how to use an n-bit repetition 
code for encoding/decoding. This is possible by simply 
adding pre-encoding and post-decoding classical steps to 
the basic protocol. The message bits (U, U') are pre- 
encoded into a pair of logical bits 

U = U 1 U 2 ---U n , U' = U' l U' 2 ---U' n , (10) 

via the n-bit repetition code. Each pair of physical bits 
(C/fe, UL) is then subject to the same encoding as before, 
i.e., lattice encoding (Uk,U' k ) — > a UkU > := a^, masking 
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Q!fe — ► Q-k + oim = a and quantum preparation a — > \a). 
Then, after n message modes, Bob will have collected 
perturbed versions of the n pairs (Ui, U[) 7 • • • , (U n , U„). 
By applying standard error recovery (majority voting), 
he will then perform the post-decoding of (U,U'). In 
the same way as before, these instances of MM (each 
one carrying a single physical bit of a codeword) must 
be randomly switched with instances of CM, where Alice 
skips encoding and simply sends Gaussian signals a for 
testing the channel (exactly as in Fig. [3|) 

Let us choose a repetition code with n = 35. Then, 
consider a critical half-step ft = 1. Such a choice im- 
plies p ~ 32% which leads to e ~ 1% for the logical 
bits (U, U'). Then, let us also choose c = 1/2, so that we 
again achieve an efficiency £ — 1/35. Let us then analyze 
the effect of a UGQCM attack. On every cloned system 
(with noise <j%), Eve detects the complex amplitude via 
heterodyne detection, therefore, estimating Alice's signal 
amplitude a up to a total noise A^ = 1 + a E . After Al- 
ice's declaration of the mask ajw, Eve derives the message 
amplitude and, therefore, a pair of physical bits (t/ fel U' k ). 
Each physical bit will be affected by an error probability 
p(Ajs). After n eavesdropped message modes, Eve will 
be able to decode Alice's logical bit by majority voting 
up to an error probability P E = P n [p(A#)]. For each 
logical bit, the acquired information is simply equal to 
1 — H(Pe). As a consequence, for each message mode, 
Eve acquires on average 

I AE (a 2 ) = 2[l-H(P E )]/n, (11) 

bits of information (simply because 2 logical bits are sent 
via n physical systems). 

Let us then consider the probability of Eve to evade M 
control modes. Since the control mode is implemented 
exactly as before, we have again Hm((t 2 ) as in Eq. ((SJ). 
Such a quantity can be again combined with the one of 
Eq. (fTTj) . After N runs of the protocol, we have an aver- 
age of cN control modes and (1 — c) N message modes, so 
that Eve's survival probability is again n c jv((7 2 ) := P and 
the stolen information is equal to (1 — c)NIae{o~ 2 ) '■= I- 
Then, for every er 2 , we can again evaluate the curve 
P = P(I). According to Fig. the best choice for 
Eve is a UGQCM with a 2 ~ 0.3, which enables her to 
steal only 10 bits of information before being detected 
(for P — 1%). Such a result is a strong improvement 
with respect to the basic protocol, where 80 bits were 
left to Eve. Notice that, for a low value of the noise 
like a 2 = 0.1, Eve gets ~ 1 bit while Alice transmits 
~ 320 bits of information by using N ~ 1.1 x 10 4 sys- 
tems. The maximal length of QDC is here bounded by 
4(1 - c){ncr)~ l ~ 3500 bits, i.e., A~ 1.2 x 10 5 quantum 
systems. 



CONCLUSION AND DISCUSSION 

We have considered Alice and Bob confidentially com- 
municating without resorting to QKD. Such a task is in 
general risky and very demanding. However, here we 
have shown how to construct a QDC protocol which uses 
the same quantum resources as standard QKD, even if 
they are exploited with a different logic. Such a proto- 
col is sufficiently confidential since it combines real-time 
checks of the channel and a suitable masking of the se- 
cret information. In particular, the maximum stolen in- 
formation (i.e., the lack of complete secrecy) can always 
be decreased by increasing the number of controls at the 
expense of efficiency. As an alternative approach we have 
also suggested the use of error correcting codes, in such a 
way as to amplify the difference of information between 
the eavesdropper and the honest user. 

As a natural consequence of a demanding task like 
QDC, our protocol allows an effective communication 
only when a small amount of noise affects the quantum 
channel, thus restricting its application to relatively short 
distances. Despite this restriction, there are non-trivial 
situations where it can be used in a profitable way. One 
of the possible applications concerns entity authentica- 
tion [H, where one of the users (e.g., Bob) identifies the 
other (Alice) by comparing the bits of a pre-distributcd 
and secret authentication key if a ut- Using the QDC pro- 
tocol, the honest users have the chance to perform this 
task without wasting too many quantum resources. For 
instance, let us consider the case where Eve does not per- 
turb the quantum channel but impersonates Alice. Such 
a quantum impersonation attack [9( is promptly revealed 
by a small QDC session, where Bob receives directly the 
bits of K ant and, therefore, performs an immediate com- 
parison with his secret data. By contrast, in actual QKD 
protocols, such an attack can be revealed only after the 
generation of the encryption key K enc (to be used in the 
private comparison of iT a ut)- This clearly requires the 
distribution and detection of many quantum states (ide- 
ally infinite) and, therefore, the useless manipulation of 
a huge amount of quantum resources (especially when 
entity authentication is mutual). In general, since our 
QDC scheme adopts the same quantum hardware as stan- 
dard coherent state QKD, one can also consider random 
switching between QDC (for authentication) and QKD 
(for key generation). 

As a final remark notice that our security analysis 
concerns the case of individual attacks (where Eve does 
not exploit any quantum memory). In future work it 
would be interesting to investigate the performance of 
the protocol in the presence of collective attacks, where 
Eve exploits a quantum memory to store all her out- 
put probes and performs an optimal coherent measure- 
ment. It would be also interesting to extend the security 
analysis to other forms of Gaussian interactions (i.e., not 
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referable to a UGQCM) and even to non-Gaussian inter- 
actions, that may play a role against the usage of repeti- 
tion codes. 
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